#### Descriptive DoS Attack Data ####
#Load pkgs#
library(tidyverse)

#Load DoS data

#Pro-government websites
df_ve_gover <- read_delim("input/df_ve_gover.csv", 
                        ";", escape_double = FALSE, col_types = cols(date_text = col_date(format = "%d/%m/%Y")), 
                        trim_ws = TRUE)

#Main sample of independent and private news outlets
df_ve_all <- read_delim("input/df_ve_all.csv", 
                      ";", escape_double = FALSE, col_types = cols(date_text = col_date(format = "%d/%m/%Y")), 
                      trim_ws = TRUE)

#Plot the occurrence of measured DoS attacks on independent and private news outlets over time
plot_ve <- ggplot(df_ve_all) +
  geom_point(aes(date_text,factor(off_rob,labels = c("No","Yes")),color = factor(off_rob)))+
  scale_x_date(date_breaks = "1 month", date_labels ="%b")+
  geom_vline(aes(xintercept=as.numeric(as.Date("2017-12-10"))),color="black",lwd=0.5,lty="dashed")+
  geom_vline(aes(xintercept=as.numeric(as.Date("2018-05-20"))),color="black",lwd=0.5,lty="dashed")+
  facet_wrap(~name,nrow=5)  +
  xlab("Date") + ylab("Attacked") +
  scale_color_manual(breaks = c("0","1"),
                     values=c("grey80", "black")) + guides(colour=FALSE) +theme_bw()


#Figure 1: Measured DoS attacks
plot_ve
ggsave("output/figures/Figure_1_incidents_dos.pdf",width=9, height=5)
#Number of attacks as stated in text on p.13
print(summary(factor(df_ve_all$off_rob)))
#19 attacks


# Figure A.1: Measured DoS attacks on government-affiliated websites
ggplot(df_ve_gover) +
  geom_point(aes(date_text,factor(off_rob,labels = c("No","Yes")),color = factor(off_rob)))+
  scale_x_date(date_breaks = "1 month", date_labels ="%b")+
  geom_vline(aes(xintercept=as.numeric(as.Date("2017-12-10"))),color="black",lwd=0.5,lty="dashed")+
  geom_vline(aes(xintercept=as.numeric(as.Date("2018-05-20"))),color="black",lwd=0.5,lty="dashed")+
  facet_wrap(~name,nrow=2)  +
  xlab("Date") + ylab("Attacked") +
  scale_color_manual(breaks = c("0","1"),
                     values=c("grey80", "black")) + guides(colour=FALSE) +theme_bw()

ggsave("output/figures/Figure_A1_incidents_pro.pdf",width=9, height=5)


#Figure A.2: Duration of attacks
df_ve_all$offline_duration <- ifelse(df_ve_all$offline>0,df_ve_all$offline*24,NA)
summary(df_ve_all$offline_duration)
df_attacked <- filter(df_ve_all,!is.na(offline_duration) & off_rob==1)

df_attacked <- mutate(df_attacked, offline_duration=round(2*offline_duration,0)) #since measurement is every 30min

#Per attacked outlet
df_attacked_name <-df_attacked %>% dplyr::group_by(factor(name)) %>% mutate(duration=median(offline_duration))


ggplot(df_attacked, aes(x=offline_duration)) + geom_histogram(binwidth=.5, colour="black", fill="white") + 
  facet_wrap(~name,nrow=2) +
  geom_vline(aes(xintercept=df_attacked_name$duration),
             linetype="dashed", size=1, colour="black") +
  xlab("Duration of attacks (no. failed measurements)") + ylab("Number of attacks") +
  scale_y_continuous(breaks=c(2,4,6,8,10))  +theme_bw()

ggsave("output/figures/Figure_A2_duration.pdf",width=8, height=4)
